CVE-2026-4690 is a sandbox escape vulnerability in Mozilla Firefox caused by incorrect boundary conditions and an integer overflow in the XPCOM component. This vulnerability allows an attacker to escape the sandbox environment, potentially leading to arbitrary code execution or privilege escalation. It affects Firefox versions prior to 149 and corresponding ESR and Thunderbird versions. Mozilla fixed this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. The vulnerability is rated critical with a CVSS 3.1 base score of 9.6 (AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:H). No known exploits have been observed in the wild. The vendor advisory confirms the fix and recommends updating to the patched versions.

Successful exploitation of this vulnerability could allow an attacker to escape the sandbox environment in Firefox, potentially leading to full compromise of the affected system. The vulnerability impacts confidentiality, integrity, and availability with high severity. However, exploitation requires user interaction. No known active exploitation has been reported.

Mozilla has released official fixes for this vulnerability in Firefox 149, Firefox ESR 115.34, Firefox ESR 140.9, Thunderbird 149, and Thunderbird 140.9. Users and administrators should update affected products to these versions or later to remediate the vulnerability. Patch status is confirmed by the vendor advisory. No additional mitigation steps are indicated beyond applying the official updates.